CVE-2026-77605: Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution)
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can execute the sibling script as the current user instead of opening the selected file. This issue is fixed in version 8.9.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Notepad++to a version that resolves this vulnerability.Fixed in 8.9.8
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of Notepad++ versions before 8.9.8 on Windows 10 or Windows 11 are exposed when they use the Folder as Workspace feature and invoke Run by system on an attacker-controlled or attacker-prepared text file.
What must an attacker provide or persuade the user to do?
The attacker must place a command script alongside the target text file, with a name formed by appending .cmd to the selected text-file path. The user must then select the text file and invoke Folder as Workspace Run by system.
Does exploitation require elevated privileges?
No. The vulnerability can execute the command script as the current user, and the listed vector indicates no privileges are required before exploitation. User interaction is required.
What should be done if patching cannot happen immediately?
Avoid using Run by system from Folder as Workspace on untrusted or externally supplied text files, particularly where similarly named .cmd files may be present. Upgrade to Notepad++ 8.9.8 when possible.
How can I check for potentially malicious file pairs?
Look in workspace folders for a text file and a sibling command script whose filename is the text-file path with .cmd appended, such as a selected file named document.txt paired with document.txt.cmd. These pairs are relevant where users may invoke Run by system on the text file.